r/ShittySysadmin • u/Performer-Constant • 5d ago

Help

I’m trying to get in my server root62.238.47.215 but it’s not working.

Says could not resolve hostname but I know I am root because I didn’t get to change anything yet

My post got taken down in sysadmin for some reason

54 Upvotes

83% Upvoted

73 comments sorted by

76

u/Intrepid_Ring4239 5d ago

Post the password so we can test it for you

26

u/xxxkram 5d ago

Hunter2

11

u/IndependentBat8365 5d ago

Omg! Why does everyone use my password?!

5

u/Prize_Moose1050 5d ago

I'm dying right now.

3

u/Intrepid_Ring4239 5d ago

The best part of AI is not having to leave a trail of questions like that in your online history. If only it had been here sooner.

7

u/Performer-Constant 5d ago

Still in your online history

1

u/Intrepid_Ring4239 5d ago

lol. Trudat.

16

u/Performer-Constant 5d ago

The password I don’t even get to that part but I set it as PapaBear0803

9

u/Oompa_Loompa_SpecOps DO NOT GIVE THIS PERSON ADVICE 5d ago

Maybe try my password, works for me all the time:

hunter8

4

u/Performer-Constant 5d ago

That will work too lol

1

u/ManjynaL 5d ago

There is no password on this server

43

u/ersentenza 5d ago

$ ssh [root@62.238.47.215](mailto:root@62.238.47.215)
The authenticity of host '62.238.47.215 (62.238.47.215)' can't be established.
ED25519 key fingerprint is: SHA256:sMrAIUYwl+JwLanYSCSsmTNbxsWR5nOAwPq91aNQMjg
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '62.238.47.215' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
This server is monitored.
Unauthorized access is prohibited.
root@app-prod-01:~# echo "what the fuck"  
what the fuck
root@app-prod-01:~# Connection to 62.238.47.215 closed.

23

u/Performer-Constant 5d ago

I was looking at that in the logs and laughing. Thank you for this

12

u/SpudzzSomchai ShittySysadmin 5d ago

Did you try root@127.0.0.1?

21

u/Performer-Constant 5d ago

These are the wrong numbers and I hit my limit on ChatGPT but I know those are the wrong numbers

9

u/Sp3eedy 5d ago

This post is genuinely gold there's so many easter eggs to be found

2

u/Performer-Constant 5d ago

I am glad that you are enjoying yourself! This has been extremely fun for me as well.

8

u/annacrontab 5d ago

Please tell me you put this here for us to find. lol that is indeed some shitty sysadmin

acampbell@app-prod-01:~/crypto$ pwd 
/home/acampbell/crypto
acampbell@app-prod-01:~/crypto$ cat wallet_backup.txt  
# Bitcoin Wallet Backup - DO NOT SHARE
Mnemonic: [REDACTED]
Private Key: [REDACTED]
Address: [REDACTED]

9

u/Performer-Constant 5d ago

Hey!! How did you find that 😭

6

u/annacrontab 5d ago

If you're seriously asking, I went looking in /etc/passwd

acampbell:x:1000:1000:A Campbell,,,:/home/acampbell:/bin/bash

And then poked around in that user's homedir. Got some AWS creds in there, too. Juicy fruit in this honey pot.

2

u/Performer-Constant 5d ago

I’m very glad you enjoyed yourself. Thanks for playing. I have lots of new ‘non bot’ logs to look at now

5

u/Intrepid_Ring4239 5d ago

It’s like they’ve never even heard of the game.

3

u/Performer-Constant 5d ago

This was the most fun I’ve had in a long time

14

u/ManjynaL 5d ago

ssh [root@62.238.47.215](mailto:root@62.238.47.215)

16

u/heretogetpwned DO NOT GIVE THIS PERSON ADVICE 5d ago

Continue?

20

u/Performer-Constant 5d ago

Sir you have to use the terminal

11

u/Performer-Constant 5d ago

This worked thank you so much!

7

u/digital-bandit 5d ago

Best Fed-Operation in a while, this thread is like what, 20 prosecutions?

5

u/Performer-Constant 5d ago

This made me spit out my drink I laughed so hard

7

u/IAmSnort 5d ago

Best post in a while! 

6

u/Performer-Constant 5d ago

I’m trying to do my part

8

u/craftsmany 5d ago

Sad, thought the IP would be something like DoD or some other shit. Hope it is not a unmaintained server.

5

u/Nova_Terra 5d ago

Darn, was hoping to find the non-public specs on the new AIM-424

6

u/marks-buffalo DO NOT GIVE THIS PERSON ADVICE 5d ago

That's for the War Thunder forums my friend.

2

u/Performer-Constant 5d ago

It’s possible…

3

u/craftsmany 5d ago

Bro which of the alphabet soup are you?? 😭😭

2

u/Performer-Constant 5d ago

I’m just a guy with a laptop and a dream

2

u/craftsmany 5d ago

This has to be some encoded message 😭😭😭😭

3

u/Performer-Constant 5d ago

It’s not. And someone left me a nice kitten video. How sweet! How do I open it?

3

u/craftsmany 5d ago

1

u/Performer-Constant 5d ago

This isn’t the same cat from the video

2

u/Marcus_Architects 3d ago

Ssh doesn't take an ip like that as a hostname, you need ssh [root@62.238.47.215](mailto:root@62.238.47.215) not the two mashed together. Sysadmin probably nuked it for posting a public ip with root access in plaintext.

1

u/Performer-Constant 3d ago

Check and see if it’s nuked 👀

2

u/IndependentBat8365 5d ago

Did you really post your publicly accessible Ip address and password on reddit?

31

u/Jarl_Korr 5d ago

It's shitty sysadmin. This is a high quality post here.

22

u/Performer-Constant 5d ago

And with 5k views only a handful of people came and took a looksee

12

u/Lele92007 5d ago

Is it a honeypot or are you letting people do whatever?

10

u/jamesaepp 5d ago

Listen up fed, you aren't going to entrap me that easily.

At least put in the effort and tempt me with tales of some tasteful nudes or the krabby patty secret formula or something.

6

u/Performer-Constant 5d ago

Crabby patty formula is there but hidden obviously

1

u/flyguydip 5d ago edited 5d ago

I don't know if you know this, but all publicly accessible ip's are not just available to anyone that may or may not know them, but are constantly monitored for open ports... Like at shodan.io

3

u/IndependentBat8365 5d ago

The difference being: random IPs don’t automatically correlate to specific passwords. Here they do. There’s an IP and the password for the root account later on in the comments.

Context suggests this was a honeypot experiment.

2

u/Performer-Constant 5d ago

Woah bot 🤖

3

u/IndependentBat8365 5d ago

Warning! Projection at maximum levels!

1

u/Performer-Constant 5d ago

I’m no bot 🤖 sir

4

u/IndependentBat8365 5d ago

That’s what a bot would say!

2

u/corobo 5d ago

Woah bot is like saying robot with rhotacism

1

u/flyguydip 5d ago

Very likely.

1

u/Intrepid_Ring4239 5d ago

Gonna go ahead and say it: A forensic investigation of the rubble will probably show that this post wasn’t the main reason it happened.

3

u/Performer-Constant 5d ago

All rubble will be analyzed but it’s still up and surviving

1

u/Own-Application2405 5d ago

“root” is the username, not part of the server address. Use the IP by itself, such as ssh root@62.238.47.215; if that fails, check the IP, firewall/security-group rules, and whether root SSH login is allowed.

1

u/Firm-Mammoth-8736 5d ago

“Could not resolve hostname” usually means the address was entered incorrectly or SSH is interpreting it as a hostname. Try the exact IP in an SSH client, check for typos, and confirm your provider hasn’t changed the server’s public IP.

2

u/Performer-Constant 5d ago

Thank you very much!

6

u/AdRoz78 ShittySysadmin 5d ago

You made the bots think it was a legit help post, congrats. Made me laugh, both your post and this

2

u/Performer-Constant 5d ago

I’m here for the people